Harden SIMD admission notes

Author: eldryoth

docs/SIMD_ACTIVATION_CHECKLIST.md

@@ -50,6 +50,12 @@ caller-derived values to callee-saved vector registers, the admission package
 must also account for any compiler-generated spill/restore slots and prove that
 those slots are wiped or never contain caller-derived data.
 
+For Windows x64 specifically, XMM6 through XMM15 are callee-saved. AVX2 or
+AVX-512 admission on MSVC targets must prove that compiler-generated
+callee-saved XMM spill/restore slots do not retain caller-derived vector
+values, or use an ABI boundary that prevents those spills from carrying
+secret-bearing intermediates.
+
 For wasm `simd128`, source-level register cleanup is not sufficient evidence.
 The wasm runtime/JIT owns final register allocation and may rewrite the
 generated code. A wasm backend cannot be admitted until the selected runtime

src/scalar.rs

@@ -265,7 +265,7 @@ fn first_padding_index_unchecked(input: [u8; 4]) -> usize {
             false,
             "first_padding_index_unchecked called with no padding"
         );
-        4
+        0
     }
 }
 

src/simd/x86.rs

@@ -188,16 +188,16 @@ where
         scalar_encode_block::<A, 12, 16>(input, output);
         return;
     }
+    debug_assert!(is_standard_or_url_safe_family::<A>());
 
     let mut staged = [
         input[0], input[1], input[2], input[3], input[4], input[5], input[6], input[7], input[8],
         input[9], input[10], input[11], 0, 0, 0, 0,
     ];
 
-    // SAFETY: `staged` and `output` are valid 16-byte arrays. The function's
-    // target-feature contract enables SSSE3/SSE4.1. The loads and stores are
-    // unaligned variants, and the shuffle mask uses `0x80` lanes only for
-    // zero-filled bytes. The SIMD path is non-dispatchable test evidence.
+    // SAFETY: fixed arrays bound the unaligned load/store, the target-feature
+    // contract enables SSSE3/SSE4.1, and the Standard-family guard above runs
+    // before the SIMD-only arithmetic mapper.
     unsafe {
         let input_vec = _mm_loadu_si128(staged.as_ptr().cast::<__m128i>());
         let shuffle = _mm_setr_epi8(2, 1, 0, -128, 5, 4, 3, -128, 8, 7, 6, -128, 11, 10, 9, -128);